Is there a patch available for CVE-2026-6180?

Yes, a patch is available for CVE-2026-6180. Update the affected software to the latest version immediately.

PaperCut MF CVE-2026-6180

Q: What is the CVSS score of CVE-2026-6180?

CVE-2026-6180 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27231 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-05-05 PaperCut

GHSA-hqg4-rx24-2464

Authentication Bypass HP

4.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 05, 2026 - 08:01 EUVD

Analysis Generated

May 05, 2026 - 07:30 vuln.today

CVSS changed

May 05, 2026 - 07:22 NVD

4.1 (MEDIUM)

DescriptionCVE.org

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notification fails to reach the server, the server may reject the initial data chunk while erroneously accepting subsequent chunks before a connection reset completes.

This leads to the registration of a truncated badge ID string. While this typically results in an authentication failure, the vulnerability is compounded in environments utilizing custom badge-ID post-processing scripts. In such configurations, the truncated string may be transformed into a valid ID belonging to a different user, leading to unauthorized session establishment (Incorrect User Login) on the device.

AnalysisAI

Race condition in PaperCut MF badge-swipe processing from HP multifunction devices allows unauthorized user login when custom badge-ID post-processing scripts transform truncated badge strings into valid credentials of different users. The vulnerability requires specific network conditions (dropped packets, out-of-order sequence counters, failed sequence reset notifications) and custom script configuration, affecting physical device authentication in networked printing environments. No public exploit identified at time of analysis.

Technical ContextAI

PaperCut MF integrates with HP multifunction devices via badge-swipe authentication protocols that transmit fragmented data chunks with sequence counters. The root cause (CWE-367: Race Condition) occurs in the server-side reassembly logic when sequence reset notifications fail to reach the server during out-of-order packet delivery. The server rejects the initial chunk while accepting subsequent chunks before connection reset completes, resulting in truncated badge ID registration. Environments running custom badge-ID post-processing scripts introduce a secondary transformation step that can convert truncated strings into valid user identifiers through string manipulation or lookup logic, bypassing the intended authentication mechanism.

RemediationAI

Consult PaperCut security bulletin (https://www.papercut.com/kb/Main/papercut-ng-mf-and-papercut-hive-security-bulletin-may-2026/) for vendor-released patch version and deployment timeline. As interim mitigations: disable custom badge-ID post-processing scripts if operationally feasible (tradeoff: loss of custom badge transformation logic); implement network reliability measures to reduce dropped packets and out-of-order delivery (QoS, wired connectivity over wireless, redundant network paths); monitor badge authentication logs for truncated or anomalous badge ID registrations and failed authentications; implement additional authentication factors (PIN, LDAP verification) on MFD devices to prevent unauthorized login even if badge processing is compromised; segment badge-swipe devices onto isolated network subnets with stricter ACLs to reduce network instability. High-confidence remediation requires vendor patch confirmation and testing in custom script environments.